Source Verification: Integrity: submission v3, hash and Ed25519 signature valid, 11 sources, all HTTPS and allowlisted (github.blog, theregister.com, anthropic.com, techcrunch.com, thenextweb.com, theverge.com, sdxcentral.com, infoworld.com); no allowlist additions. Snapshots source-0..10.html.gz in sources/2026-11/four-cases-on-developer-code-github-published-a-training-policy-anthropic-a-retention-policy-and-researchers-reported-grok-build-and-zcode-uploads/ were all status 200 with real article content (no bot-check pages, no archive fallback); I re-hashed every decompressed snapshot and all 11 sha256 values match the manifest. suspicious_patterns is null for all 11 sources, so no prompt-injection flag arose. I read all 11 from the saved snapshots, as the command prescribes, and did not re-fetch live. source-0 (GitHub blog, Mar 25, 2026): confirms the April 24 date, the Free/Pro/Pro+ scope, 'Copilot Business and Copilot Enterprise users are not affected', the 'at rest' exclusion text, 'could be used for model training unless you opt out', and that the data 'will not be shared with third-party AI model providers' (the post also says it may be shared with affiliates including Microsoft, which the article omits). source-1 (The Register, Mar 26 00:13 UTC): confirms /settings/copilot/features, 'thanks to the terms of their contracts', Business/Enterprise exempt (it also says students and teachers are spared; not used). source-2 (GitHub changelog, Sept 1): confirms 'requires data retention by default to operate Anthropic's safety classifiers', 'Retained data is not used to train Anthropic's models', policy off by default for Business/Enterprise, 'Leaving it off keeps Claude Fable 5.1 unavailable', 'through the end of the calendar year', contact the GitHub account team, 'continued use of the models will require EFS', and availability to Pro+, Max, Business and Enterprise. source-3 (GitHub changelog, Nov 9): same retention paragraph and end-of-year exemption, now naming Fable 5.2, 5.1 and 5. source-4 (Anthropic, Sep 1): confirms 'introduced 30-day data retention starting with Fable 5', 'not motivated by a desire to train on enterprise data', 'never trained on enterprise data without explicit permission', EFS stores data 'in cloud infrastructure controlled by the customer, not Anthropic', 'starting later this fall', ZDR for eligible customers on Fable 5 and 5.1 'until EFS is ready' (Anthropic gives no calendar date; the end-of-year date is GitHub's, and the article attributes it to GitHub); the post also says customer-owned storage, customer-managed keys and automated review are each opt-in. source-5 (TechCrunch, Sep 1; 'On Tuesday' is correct for Sep 1, 2026): the quoted sentence on monitoring is verbatim; the piece is largely a restatement of Anthropic's announcement (it quotes the announcement's 'never trained' line) and the article does not describe it that way (see corrections). source-6 (The Next Web, Jul 14 20:48 UTC): 'July 12', cereblab, v0.2.93, Google Cloud Storage bucket, the 'nothing from your codebase transmitted to xAI servers during a session' marketing claim, 'did nothing, according to multiple reports', 'no independent audit has confirmed the deletion'. source-7 (The Verge, Jul 14 19:25 UTC, Stevie Bonifield): 'Monday' (= Jul 13; Jul 14, 2026 was a Tuesday), relays The Register, 'files it was told not to open and secrets deleted from history', 'completely and utterly deleted', 'privacy settings are always respected' (in 'a separate post'; the Verge does not name the venue of that second post, the article says 'a post on X'; minor), 'helpful for debugging issues', Cereblab's '/privacy ... per-session retention toggle, not the switch that fixed this', disable_codebase_upload: true, 'no longer fires'. source-8 (SDxCentral, Jul 17): 'found to be active by default', SpaceXAI's later post that retention is switched off by default and retained data deleted (the article words this as SDxCentral having 'wrote that retention was switched off by default'; the source attributes it to SpaceXAI's post), bug bounty $100-$20,000; it calls Cereblab an 'independent AI safety checker'. source-9 (The Next Web, Sep 22 17:10 UTC): ferstar, Sept 18 analysis, 42,411 files, 86.6% Git directories, 564 failed upload attempts (the archive itself 'never made it off his machine'; one smaller 538-file snapshot did reach the server), two settings that 'governed what happened to the data downstream', 'said nothing about automatic workspace snapshots carrying full Git history', Z.ai's post on 'Monday' (= Sep 21), v3.14.0, ferstar's recheck on 21 September, 'The development history is gone, and so is the code that did the uploading', 'rests on the word of the party who deleted', 'Nobody has said how long ZCode behaved this way ... how many workspaces it captured'. source-10 (InfoWorld, Sep 22): 'without their consent', Alibaba Cloud in China, Z.ai asked CAICT and NSFOCUS to assess, 'has never been used for model training', Cris Thomas (Semgrep) quote verbatim; it calls ferstar 'an independent Chinese blogger'. Quote test: all 34 quoted strings in the body (script run over the 11 snapshots, curly quotes and dashes normalised) are present verbatim in a cited snapshot; the one non-quoted literal `disable_codebase_upload: true` is also in the Verge snapshot. Researchers: cereblab and ferstar are named as the outlets name them; the Herald did not read their original posts and the article does not say so (see corrections). Derived figures recomputed: March 25 to April 24 = 30 days (labelled 'By the Herald's count'); November 9 to December 31 = 21 + 31 = 52 days (labelled as conditional on reading 'end of the calendar year' as December 31, 2026, and as the Herald's reading). Weekday checks: Sep 1 Tuesday, Jul 13 Monday, Sep 21 Monday, all consistent with the sources. Absence claims ('none of the GitHub changelogs, Anthropic's post or TechCrunch gives a specific day for EFS availability'; 'No source cited here gives a day for EFS availability') hold against all snapshots (Anthropic says 'later this fall', GitHub 'end of the calendar year' for the ZDR exemption). Outcome claim 'outside retests reported that both uploads had stopped; deletion rests on the vendors' statements or on assessors the vendor engaged' is supported (Verge/TNW for Grok Build, TNW for ZCode; CAICT/NSFOCUS were engaged by Z.ai per InfoWorld and TNW). Internal links: /article/2026-03/29-github-will-train-ai-models-on-copilot-user-interactions-by-default-starting-april-24-sparking-developer-backlash and /article/2026-09/03-claude-fable-51-reaches-github-copilot-on-day-one-requiring-data-retention-by-default both exist and have no corrections record. Analysis independence: at the article level it is met. Counted per outlet: The Register, The Verge, SDxCentral, The Next Web (two articles, one outlet), InfoWorld = 5 independent news outlets, plus TechCrunch (6th, largely restates Anthropic's announcement, counts but should be described as such); GitHub (blog, 2 changelogs) and Anthropic are vendor pages and not counted; the researchers' own posts were not cited. Per case: GitHub training has one independent outlet (The Register); Fable retention has only TechCrunch, a restatement; Grok Build has three (Verge, which relays The Register, SDxCentral, TNW); ZCode has two (TNW, InfoWorld). Anthropic disclosure: required - Anthropic's Fable retention terms are one of the four cases and Anthropic is named in the headline; the one-sentence disclosure ('The Herald's contributor model is built by Anthropic, whose Fable retention terms are one of the four cases.') is present at the end of the Overview, neutral, and does not characterise Anthropic beyond the sources. Anthropic statements in the body are attributive throughout ('says', 'states', 'GitHub's changelog says'); xAI/SpaceXAI and Z.ai statements are attributed to the outlets reporting them and no wrongdoing is asserted beyond what they report. Claim-accuracy greps (quantifier/absence terms) were run and each hit tested against all snapshots; 'both uploads stopped', 'in both discovered cases' and 'the two announced cases' hold for every case.